ISO 37301 certification: compliance management guide

Overview

What a compliance management system covers, why organizations seek certification, and how to build auditable evidence.

What it is

ISO 37301:2021 specifies certifiable requirements for a compliance management system. It addresses governance, compliance culture, obligations, risk assessment, objectives, resources, training, controls, speaking up, investigations, monitoring, internal audit, management review, and improvement.

Why it matters

Certification can help an organization structure fragmented legal and contractual duties, demonstrate governance, and support customers or regulators with independent assurance. It does not certify compliance with every law or prevent liability for misconduct.

How to obtain it or demonstrate compliance

1. Define the legal entity, sites, products, services, and processes inside the certification scope.
2. Buy or lawfully access the current standard and perform a documented gap assessment.
3. Implement objectives, responsibilities, controls, records, competence, and corrective-action processes.
4. Complete internal audits and a management review, then close identified gaps.
5. Select a competent certification body—preferably accredited for the standard and sector—and verify its status.
6. Complete the stage 1 and stage 2 audits, correct nonconformities, and maintain certification through surveillance and recertification.

What to review

1. Confirm the current edition, certification scope, sites, legal entities, exclusions, and certificate validity.
2. Map applicable laws, regulator duties, contracts, customer requirements, and sector-specific controls separately from the voluntary standard.
3. Test whether policies operate in practice and whether records support each material claim before the external audit.
4. Describe the standard, edition, scope, certification body, accreditation, and limitations accurately in procurement and marketing.

What to do next

Treat certification as an operating system, not a document project. Assign accountable owners, measure performance, investigate failures, correct root causes, and keep evidence current between audits.

Official sources and further reading

• ISO 37301:2021 — Compliance management systems — International Organization for Standardization
• Certification — ISO does not perform certification — International Organization for Standardization